This bounty aims to allocate up to 100,000 DOT for covering bug bounty rewards for [Open Runtime Module Library (ORML)](https://github.com/open-web3-stack/open-runtime-module-library). ORML is a community-maintained collection of Substrate runtime modules, widely used across the Polkadot/Kusama parachains.


# Context of the bounty:

The Open Runtime Module Library is a community-maintained library widely used by parachains across Kusama and Polkadot ecosystems. It’s a set of runtime pallets for commonly used functions that parachains may need. It allows constructing parachains with less time for development and focusing more on unique features. This helps the Kusama/Polkadot ecosystem grow faster.

Vulnerabilities in ORML are a common problem of Kusama/Polkadot community and will affect the whole ecosystem. Acala Foundation is running a bug bounty program that includes the ORML library. We propose to allocate up to 100,000 DOT to cover ORML part of Acala Bug Bounty.

# Problem Statement

ORML is a commonly used library across the Kusama/Polkadot ecosystems, vulnerabilities and security issues of this module will likely affect the whole network.

# Custody of funds

The main curator is suggested to be a multisig wallet controlled by Acala, Parity and potentially other users of ORML. Those who control the multisig wallet will be able to assess the validity and severity of found vulnerabilities, as well as to check their fixing.

# Curator Multisig Candidates (3/5 multisig)

Bryan Chen @ Acala  
Bryan is the co-founder & CTO of Acala as well as the initiator and core contributor of ORML. He is also one of the top community contributors to Substrate and Polkadot.

Shaun Wang @ Acala  
Shaun is one of the core developers at Acala, and core contributor of ORML. He is also an active contributor to Polkadot, Substrate and Cumulus.

Shawn Tabrizi @ Parity  
Shawn is one of the Lead Developers at Parity Technologies working on Substrate, Polkadot, Kusama. He specializes in FRAME, Runtime development, and benchmarking.

Wei Tang @ Parity  
Wei is one of the core developers at Parity Technologies. He maintains Frontier, the Ethereum-compatibility layer for Substrate.

Shumo Chu @ Manta  
Shumo is a co-founder of manta.network, the privacy layer for Web3 using zkSNARK. He was serving as research scientist at Algorand and assistant professor at UCSB before Manta.

# Additional costs

Acala team uses Immunefi as a service for managing bug bounty programs. 
Immunefi charges an additional 10% for each reward paid to whitehat. The service gives the next advantages:
- Manages privacy in submitting reports helps ensure that the vulnerability is fixed before being exposed to publicity;
- Immunefi serves as a third trusted party for resolving conflicts in submitting the same vulnerability by different bug bounty hunters;
- Provides secure communication with whitehats;
- Tracking & filtering out irrelevant reports;
- Exposure to a wide set of whitehat hackers.

# Cost Estimate

It is not possible to precisely estimate costs, as we don't know how many bugs with what severity can be found. Acala is working hard on finding vulnerabilities ourselves and doing frequent security audits. We propose to allocate rewards that will cover ~1.5 of the most severe bugs; and, if necessary, we can propose another allocation.

# Technical Process

Bug bounty rewards for ORML are paid in DOT. Each vulnerability needs separate payment, for which can be created child bounties with reward amount and 10% of Immunefi fee. The child bounty is curated by Immunefi team wallet, with the support and supervision of the on-chain curator,  and they manage to pay out to the whitehat and take their commission.

The following consists of the next steps:
- Whitehat submits bug report to Acala via Immunefi;
- The report will be accessed by the Acala team for its validity and specified level of severity; 
- The bounty details will be disclosed to the relevant party (e.g. Parity and affected parachain teams);
- After the bug is mitigated, the Acala team will determine the bounty value based on severity along with the curator;
- A child bounty will be created by the curator and funds transferred to pay out whitehat + fee to Immunefi for the work completed.

# Measure of Success

Vulnerabilities and security issues of ORML found by whitehat from bug bounty programs are carefully fixed on time.





SMS DAO Mobile SMS Protocol integreation 

### Bounty to back Apillon Web3 development platform as an open-source, common good infrastructure

**Planned on-chain publish date: July 18th 2023**

**Requested DOT: 999,999**

> Respecting the feedback we garnered and addressing the concerns raised by some community members, we’re introducing certain changes to the Proposal that would, hopefully, reassure everyone of the ecosystem-first objectives of Apillon’s transition to an open-source infrastructure.
Read more about our commitment to respecting community voice and delivering user-first solutions long-term: [How ecosystem engagement helped steer the way of the Apillon Proposal.](https://blog.apillon.io/how-ecosystem-engagement-helped-steer-the-way-of-the-apillon-proposal-93af9f568fdb)

With this Proposal, the Apillon platform would transition to an open-source infrastructure solution with permanent freemium access, governed by the community, and thus become a common good project, further spurring Web3 adoption, Polkadot ecosystem growth, and DOT utility.

Apillon [(apillon.io)](http://www.apillon.io) is a Web3 development platform ([app.apillon.io](http://app.apillon.io)) empowering developers to easily build dapps and other Web3 products in the Polkadot ecosystem.

![](https://miro.medium.com/v2/resize:fit:4800/format:webp/1*Kf4rg1crJ13CDOQHpcVWKw.png)

Currently, the platform provides the functionality of dashboard-based deployment of Web3 services and API connectivity - the parachains’ functionalities are abstracted and translated into ready-to-use, few-click Web3 services that can be combined to power multi-chain Web3 projects.

Through DOT-based open governance by the Apillon community, the platform would undergo future upgrades, including integrations of voted parachain and other services, to best respond to users' needs and deliver user-oriented opportunities for Web3 adoption.

> **The updates to the Proposal are as follows:**
- Proposal format changes from Treasury to Bounty to align with OpenGov funding schemes and give more control to the governance and treasury community, as a direct answer to raised concerns in the public discussion phase.
- The total funding amount changes slightly to compensate for the DOT price volatility and treasury track placement.


![](https://ipfs.apillon.io/ipfs/QmTdJ426x3tpPBmygbafryS4kgqtJu6HtsHQGTBZg8GjCP)

We want to make the concept of Apillon’s Treasury Proposal as comprehensive and transparent as possible. We will do our best to provide additional explanation and information you might request.

**Payout structure**

![](https://ipfs.apillon.io/ipfs/QmYKZYp1Z9mrRrVY374aafMx9K2mg8ELYx8nVxXk6hudMo)

Additional links:

* [The full Apillon Proposal](https://ipfs.apillon.io/ipfs/QmZmZLdpeuVN9vpw3WNzJh8F62vzqwZDmrXdh5mBRB1GVh)
* [The Apillon platform Quick Demo](https://www.youtube.com/watch?v=qQJnuvUo-xo)
* [The official Apillon Proposal announcement](https://blog.apillon.io/apillon-aims-to-foster-web3-adoption-as-a-common-good-infrastructure-solution-on-polkadot-6566508190c5)

- [The AAG on Polkadot and Kusama](https://www.youtube.com/watch?v=ZuE-zxEsOAk) 

Please post any questions, concerns, or feedback in one of the following ways:

* In the comments section below
* In the Polkadot Forum comment section (informal)
* In the Polkadot Direction Element channel comments section (informal)

UPDATED: (Big Spender) Bounty to back Apillon Web3 development platform as a common good infrastructure

Treasury

- This bounty is for allocating up to 100,000 DOT for bug bounty rewards for the Open Runtime Module Library (ORML).
- ORML is a widely used library in the Polkadot/Kusama ecosystems and vulnerabilities in it can affect the whole network.
- The funds will be held in a multisig wallet controlled by Acala, Parity, and potentially other users of ORML.
- The bug bounty rewards will be paid in DOT and managed by Immunefi, a bug bounty program management service.
- The success of the bounty is measured by fixing vulnerabilities found by whitehat hackers.

#21 Security Bug Bounty for Open Runtime Module Library (ORML)